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ADEN C. MAGEE 


Countering Nontraditional HUMINT 
Collection Threats 


The United Stated faces a wide range of threats to its security from foreign 
intelligence activities, terrorist elements, and other non-traditional 
adversaries designed to achieve advantage over U.S. Military, 
diplomatic, and economic interests at home and abroad... Foreign 
intelligence establishments and terrorist groups acquire resources, train, 
and deploy personnel, and execute both clandestine and covert 
intelligence operations against us...' 
The National Counterintelligence Strategy of the 
United States of America 


The National Counterintelligence Strategy and other national guidelines 
address the relevance of nontraditional adversaries as active threats to the 
United States that require counterintelligence (CI) countermeasures. Dating 
back to its original 1981 version, and as amended over the years, Executive 
Order 12333 provides a definition of CI that is sufficiently broad to 
encompass any foreign entity conducting intelligence collection targeting 
the U.S.? Citing “terrorist elements” and “other nontraditional adversaries” 


Aden C. Magee, a retired United States Army and Joint Specialty Officer, has 
been Counterintelligence (CI) Staff Officer and Counterintelligence 
Coordinating Officer in U.S. Department of Defense organizations having 
30,000 to 80,000 personnel. He recently implemented a program in Iraq to 
enhance CI and human intelligence (HUMINT) operations in an irregular 
warfare environment. He is currently a consultant supporting the U.S. 
Department of Homeland Security as the CI program coordinator for a 
47,000-person organization with unique concerns regarding unconventional 
and nontraditional irregular adversarial intelligence collection threats. 
Articles by Mr. Magee have been published in the American Intelligence 
Journal and The Counter-Terrorist magazine. 
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within the context of the National CI Strategy implies that the CI community 
is committed to countering enemy intelligence collection efforts supporting 
this broad category of threat on an all-encompassing basis. 

Consistent with the context of the CI strategy, nontraditional adversaries 
consist primarily of nonstate entities, such as terrorist and other criminal 
elements, to include narcotics, human, and other contraband trafficking 
organizations.* Like the state-sponsored foreign intelligence and security 
services (FISS)* that collect intelligence against the U.S. on behalf of 
traditional nation-state adversaries, nontraditional adversaries conduct 
intelligence collection to facilitate the effectiveness of their operational 
planning and execution. 

Terrorists, drug traffickers, and other categories of nontraditional actors 
pose significant threats to U.S. national security. In many cases, these are 
sophisticated entities that employ thorough operational processes to 
maximize the security and effectiveness of their operations. The fact that 
nontraditional adversaries collect information/intelligence to facilitate their 
operations is apparent in doctrine’ and practice.® Arguably, the degree of 
threat is directly tied to the degree to which these organizations are able to 
collect the information/intelligence needed to more effectively operate to 
the detriment of U.S. interests. Alternatively, the degree to which these 
collection activities can be effectively countered and neutralized will 
enhance the national security relative to these threats. Since intelligence 
collection is an integral component of the operational processes employed 
by various nontraditional adversaries, countering their collection aspects 
should be an integral component of a full-spectrum enterprise approach to 
countering these threats to U.S. national security. 


A Cl METHODOLOGY REQUIRED 


In a manner that had historically been associated only with state-sponsored 
FISS, many nontraditional organizations have the resources to facilitate 
sophisticated intelligence collection efforts. The fact that terrorist 
organizations conduct preoperational intelligence collection to support 
planning and facilitate effective attacks is commonly accepted.’ Other 
criminal elements, such as well-resourced narcotics, human, and other 
contraband trafficking organizations, can enhance the effectiveness of their 
illegal activities through the collection of information/intelligence to 
develop an understanding of law enforcement and security efforts that are 
emplaced to counter their activities. 

The effectiveness of the national CI community is reliant on its ability to 
adequately counter the full range of adversaries collecting information to 
the detriment of U.S. national security interests. The effectiveness of any 
given CI program is largely reliant on the understanding of the intelligence 
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collection methods employed by the adversaries of the organization for which 
the CI program is intended to protect against. For strategic CI programs, this 
largely involves the understanding of the methods employed by sophisticated 
state-directed FISS to recruit and control well-placed human sources. CI 
professionals leverage this understanding of adversarial collection methods 
in the conduct of CI investigations, operations, and other activities, as well 
as the training of the organization’s personnel to facilitate the widest 
possible ability to detect and report indications of adversarial targeting. 

CI professionals are well-versed in the methods of traditional intelligence 
collection that are commonly associated with state-directed FISS. This 
level of understanding is based largely on the study of decades of 
espionage and counterespionage successes and failures. Traditional 
state-directed espionage is characterized by well-established methods that 
are generally consistent among all sophisticated FISS due to their 
time-proven effectiveness. In addition, the manner in which these methods 
are employed is generally consistent among FISS, due largely to the 
common constraints involved in operating at the behest of a nation-state 
whose national interests would be impacted negatively if proven to be 
sanctioning espionage against another country. 

Nontraditional intelligence collection elements employ methods similar to 
those of traditional state-sponsored FISS. These similarities should provide 
a basis for establishing a methodology for countering the nontraditional 
collection threat. However, the fact that similarities exist should not lead to 
the false generalization that methodologies and programs based on 
traditional FISS practices are equally applicable to nontraditional 
adversaries. 

The CI requirement to counter the collection efforts of nontraditional 
threats must be based on an understanding of the methods employed by 
the various nontraditional adversaries. But no comprehensive documented 
research distinguishes anticipated nontraditional intelligence collection 
threat methods from those associated with traditional FISS. Given the 
prolific threat that nontraditional elements pose to U.S. national security 
interests in general, an approach to countering their collection activities 
that is developed incrementally over time, based on the study of 
post-incident successes or failures, accepts substantial risk in the interim. 

As the term “counterintelligence’”’ implies, the specific countermeasures 
will be increasingly effective when based on a valid understanding or 
anticipation of the specific adversarial collection methods employed. The 
nuances of intelligence collection conducted to support the activities of 
nontraditional organizations pose significant implications. 

CI seeks to protect the integrity of sensitive information. In addition to 
protection from compromise, it can be vital to the detection and prevention 
of nontraditional adversarial activities. Such elements conduct collection 
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activities based on the information they need to plan and execute their 
operations. Therefore, by identifying the specific information interests of a 
given nontraditional adversary, CI can ascertain and counter the specific 
activity the information was intended to support. In essence, the detection 
of adversarial intelligence collection provides insights regarding that 
adversary’s intentions. For nontraditional organizations that operate in a 
networked, compartmentalized, and covert manner, efforts to detect their 
intelligence collection may be among the best opportunities to identify and 
neutralize their activities. 

Based on the nation’s CI strategy and other similar edicts, the requirement 
exists to establish specific CI methods to counter emergent nontraditional 
threats. These should be based on how known human intelligence 
(HUMINT) collection methods can be adapted to generalized characteristics 
of nontraditional elements. 


ORGANIZATIONAL OBJECTIVES AND NONTRADITIONAL 
HUMINT METHODS 


An organization’s operational objectives will largely dictate how its members 
function collectively. As such, they should be a key consideration in 
analyzing the intelligence collection methods likely to be employed by 
nontraditional threats. While the range of organizational objectives among 
nontraditional elements is broad, some generalizations can be drawn upon 
to anticipate how they will conduct HUMINT collection operations in 
comparison to traditional state-sponsored FISS. 

Although the insider threat® is most commonly associated with traditional 
FISS, nontraditional elements have demonstrated the propensity to employ 
insider HUMINT sources or other similar types of access agents to 
facilitate their operations using many of the same intelligence collection 
techniques that have been honed by the most capable FISS over the years.’ 
Variations on these techniques will primarily result from differences in the 
objectives for which nontraditional elements conduct intelligence collection. 

State-sponsored services generally conduct HUMINT operations to facilitate 
strategic national objectives. In comparison, the objectives of nontraditional 
organizations generally range from immediate to near-term. For example, 
terrorists conduct intelligence operations to develop the information 
necessary to conduct an effective attack on a given target. Criminal 
organizations such as narcotics traffickers conduct intelligence operations to 
develop information regarding plans and operations directed against them in 
order to avoid detection and interdiction by law enforcement or military forces. 

The most basic distinction between FISS and nontraditional HUMINT 
collection efforts is the level of the sources needed to support their respective 
objectives. To facilitate national objectives, foreign services generally focus 
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on the identification and recruitment of insiders with access to highly sensitive 
information that can cause strategic, long-term, or permanent damage to 
another country’s national security interests. Alternatively, nontraditional 
adversarial organizations will employ insiders or similar types of access 
agents to facilitate their more immediate operational objectives, which in 
most cases do not require access to sensitive national security information. 
Generally, the collection requirements of nontraditional organizations can 
be satisfied through lower-level sources than those associated with 
traditional FISS. 

Some immediate conclusions can be drawn from the contention that 
nontraditional objectives can be supported by information provided by 
lower-level sources. Most basically, the population of potential sources is 
much larger than the one needed to satisfy FISS requirements. 

In addition, this larger number of potential targets can be more readily 
recruited as HUMINT sources in comparison to individuals of specific 
interest to FISS because many, if not most, are not likely to be subjected to 
the degree of CI awareness training that would enable them to more readily 
identify indications of adversarial targeting before it is too late. Further, a 
larger pool of candidates suggests that a greater number are more likely to 
provide information for monetary incentives or be susceptible to 
recruitment under false pretenses. Last, the lower level of information 
required by nontraditional elements may make it easier for a given targeted 
individual to rationalize its compromise based on the financial incentive 
provided or the apparent unimportance of the information. 

A prime example of the level of a source is that of the insider placed in the 
target organization and cultivated over time (a ““mole’’). Once again, the key 
factor that makes such operations less complex for nontraditional threats is 
the level of the source. Perhaps the most complex operation for a FISS is the 
placement and cultivation of an individual who progresses through the 
echelons of a government organization until reaching the position having 
access to the information for which the agent was initially emplaced to 
attain. Such sophisticated FISS operations are sometimes literally lifetime 
investments that involve a relatively lengthy process of “growing” an insider. 
Alternatively, since nontraditional organizations have more limited and 
immediate objectives that can be supported by lower-level agents, the 
emplacement of an insider (“‘mole’’) is a much more expeditious effort. These 
low-level agents can enter organizations of interest by gaining legitimate 
employment in a position with access to the desired information. As opposed 
to the more highly placed FISS insider/mole, agents of this nature may 
simply monitor and report on a target organization’s general day-to-day 
activities, rather than attempt to gain access to specific sensitive information. 

The more immediate objectives of nontraditional adversaries lead to 
another distinction. Due to the more highly classified and strategic nature 
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of information collected from a FISS insider, the value of the information is 
based largely on ensuring that the U.S. government does not know that the 
information has been compromised. For this reason, FISS operations are 
intended to remain clandestine, with extreme measures taken to protect 
their activities, even long after the source operation has been terminated. 
Alternatively, nontraditional organizations are much less bound by such an 
operational protocol. Terrorist organizations, for example, will employ a 
given insider source until the operational objective is achieved, at which 
point the insider is of no further use. For this reason, after the execution of 
a terrorist attack, a very overt and visible act, there may be no effort to 
conceal the fact that the insider supported the operation. Criminal 
organizations are closer to terrorist organizations than they are to FISS 
regarding the compromising of insider sources, but their insiders can 
frequently support their illegal efforts beyond a single immediate objective. 
Thus, as a general contrast to traditional FISS, nontraditional HUMINT 
source operations can be expected to remain covert only as long as the need 
for secrecy is required to support a given objective or operation. At that 
point, the need to protect the source or nature of the provided information 
is no longer essential. This consideration supports the contention that 
human sources employed by nontraditional elements are more readily 
expendable. 


ORGANIZATIONAL NATURE AND NONTRADITIONAL HUMINT 
METHODS 


As with operational objectives, the operational nature of an organization 
impacts the employment of HUMINT source collection methods. 

The fundamental cause in variations to traditional and nontraditional 
HUMINT source methods is the factor of risk avoidance or acceptance. 
The more risk an organization is willing or able to accept, the more 
aggressively it can operate. This distinction between state-directed FISS 
and nontraditional intelligence collection reflects the principle that the 
more an organization stands to lose if its activities are discovered, the less 
risk it will accept when conducting them. In general terms, operational 
objectives dictate that FISS operate in a more conservative manner while 
those of nontraditional organizations enable them to operate more liberally. 

FISS activities conducted against the U.S. will result in political, economic, 
and perhaps even military consequences if detected, thus making the measures 
taken to avoid compromise a national political priority of the state directing 
them. As noted, the value of the intelligence gained is largely dependent on 
protecting the fact that the information has been compromised. 
Consequently, the threshold for risk acceptance is very low among foreign 
services. Further, even in the clandestine business of espionage, unwritten 
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international community standards place generally accepted parameters on 
these activities. But nontraditional organizations are non-state and 
non-state-directed entities, so their activities are bound by few of these 
same protocols and risk avoidance considerations. Non-state elements, such 
as terrorist and criminal organizations, do not recognize many 
considerations regarding the political and economic consequences of their 
activities because they have no government that can be sanctioned or state 
that can be attacked. As such, nontraditional threats tend to employ many 
of the same concepts of asymmetry in their intelligence collection activities 
that they employ in their operations—most notably, the propensity to act 
more aggressively and with less constraint in regard to operational ethics 
and acceptance of risk. 

Under the traditional FISS construct, execution of the spotting, 
assessment, and recruitment stages of source development and control is a 
very deliberate and lengthy effort due to factors such as the level of source 
sought, security concerns, and political risk/benefit considerations. In 
virtually all cases, the assessment stage is the most time-consuming phase 
of the process due to the effort required to discreetly identify the levers of 
motivation or manipulation that facilitate recruitment. In fact, this stage of 
the traditional FISS process is typically measured in months or years. 

Nontraditional elements share few of the considerations that cause FISS 
assessment and recruitment operations to be more deliberate and lengthy. 
Their higher threshold for risk acceptance enables them to assess and 
recruit sources more aggressively and rapidly—essentially enabling them to 
conduct HUMINT source operations at a much accelerated pace. 

Generally, foreign services prefer to use positive motivating factors such as 
ideology, religion, ego, disgruntlement, or greed as exploitation for source 
recruitment, as opposed to negative motivators that include blackmail, 
extortion, or other coercive techniques such as threats of physical harm. 
Additionally, when FISS resort to negative motivating factors, their 
success is based on the belief by the targeted individual that the service 
would actually follow through on the threat. When a FISS attempts to 
recruit an insider through blackmail or coercion, however, it will not 
actually follow through on threats to disclose compromising information if 
the target individual “‘calls its bluff’ so as to diminish the risk of exposing 
itself and its country’s complicity. 

In contrast, the less constrained nature of nontraditional organizations 
suggests that they can more liberally employ negative motivating factors as 
levers for the recruitment of HUMINT sources. This, coupled with a lower 
regard for the long-term protection of source affiliation (covert versus 
clandestine nature of operations), also suggests that such organizations 
would be much more likely to follow through on threats of personal or 
physical harm, reaffirming the likelihood that this lower regard for 
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protecting sources may also result in nontraditional human sources being 
viewed as more readily expendable. 

A propensity to employ the universal motivator of fear as an operational 
expedient carries significant implications. Since coercive threats are directed 
at a basic weakness to which nearly everyone is susceptible, an extended 
assessment to identify a more subtle approach for recruitment efforts is 
unnecessary. This more aggressive and less constrained approach is the 
extreme variable demonstrating that nontraditional elements can be 
expected to exercise a significantly compressed assessment and recruiting 
cycle, thus accelerating the pace of adversarial HUMINT operations. 
Traditional motivators such as money, ethnicity, ideology, and religion 
remain among the standard means by which to recruit and control human 
sources. But organizations that are willing to make and follow through on 
threats have an almost fail-safe expedient when needed. 


THE IMPLICATIONS OF NONTRADITIONAL HUMINT SOURCE 
OPERATIONS 


Existing U.S. counterintelligence programs are designed to counter the efforts 
of sophisticated, state-directed intelligence services, which are primarily 
focused on individuals with access to classified or sensitive information of 
significant value to a foreign nation. Over time, these programs have also 
been structured on generally accepted operational parameters that are 
assumed to constrain the activities of rational, risk-adverse FISS. Based on 
the anticipated methods employed by nontraditional elements to conduct 
HUMINT source operations, such entities have an inherent capability to 
bypass or overwhelm U.S. CI capabilities due to their targets and variations 
in the methods these groups employ. This indicates a degree of 
“asymmetry” with traditional CI in regard to their collection activities. 

As the CI community focuses its limited resources on the detection and 
neutralization of strategic state-directed FISS, nontraditional adversaries can 
achieve this asymmetric advantage by targeting the relatively larger 
population of individuals who are “‘‘below the radar’’ of institutional CI 
programs. Further asymmetric advantage is gained by more aggressively 
conducting human source operations with less constraint, perhaps 
significantly accelerating the HUMINT process. A third, and largely 
coincidental, degree of asymmetry is gained from the fact that the law 
enforcement organizations responsible for countering the large majority of 
nontraditional adversaries do not have either a capability or a mentality for CI. 

Based on these conclusions, the first implication for the development of a 
proactive CI methodology is clear—either expand the spectrum of what has 
traditionally been viewed as the realm of strategic CI, or accept the risk. This 
expansion of the spectrum is intuitive, based on the larger and more readily 
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targeted population of potential human sources alone. However, expanding 
the CI support spectrum beyond the much smaller population of potential 
sources associated with the targeting of FISS activities will involve crossing 
into many law enforcement jurisdictions. For this reason, the expanded CI 
spectrum must extend to, and include, those law enforcement elements 
having primary responsibility for countering nontraditional adversaries. 

Under the current construct, and when not engaged militarily, 
nontraditional adversaries are viewed almost exclusively as law enforcement 
threats and are rarely addressed from a CI perspective. The U.S. 
counterintelligence community, focused primarily on protecting military, 
political, economic, and other national security interests, has traditionally 
sought to counter the efforts of foreign state-controlled organizations that 
are dedicated solely to collecting intelligence. Although nontraditional 
organizations also collect intelligence, and may even have dedicated 
intelligence collection elements, no distinction is currently made between a 
given nontraditional element and the intelligence collection effort 
supporting it. Since nontraditional adversaries are viewed primarily as 
criminal entities by the U.S. government, the agencies with the primary 
responsibility to counter them do not maintain the expertise to address the 
CI implications. Their clear demarcation as criminal entities results in a 
capability gap, because the U.S. agencies responsible for opposing them do 
not incorporate CI principles into their countermeasures. In essence, the CI 
professionals who are best qualified to address the collection efforts are not 
actively involved in what should be an all-encompassing approach. 

The CI community also has institutional obstacles that inhibit integration 
with law enforcement. By definition, CI is restricted to countering the 
collection activities of foreign entities. As a result, the CI community has 
focused its efforts exclusively on foreign intelligence services because they 
are the only clearly defined foreign intelligence collection entities. But, 
although nontraditional elements may not be directed by a foreign state, 
the large majority can be traced to some form of foreign nexus—placing 
their collection activities in the realm of foreign CI. Therefore, 
qualifications regarding foreign entities should not restrict CI community 
involvement in countering nontraditional transnational adversaries. 

The second primary implication drawn from the manner in which 
nontraditional adversarial intelligence collection elements operate is that 
the CI community must adapt its programs and procedures to address the 
nature of the threat. This distinction between FISS and nontraditional 
entities represents the most significant shift that CI professionals must 
undergo when developing a CI methodology to counter the current threat. 
Traditional spy-versus-spy protocols clearly no longer exist, and this is no 
longer the ‘‘gentlemen’s game”’ of espionage and counterespionage. The 
implications of this new dynamic of “‘less cloak and more dagger’”’ 
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represent significant challenges for the CI community, and CI program 
managers in general. 

One significant shift in the traditional CI approach is the degradation of 
the “ethics” of espionage. The likelihood that nontraditional organizations 
will employ and follow through on threats is a radical departure from the 
traditional CI mindset regarding opponents. In addition to accelerating the 
source recruitment cycle, this factor essentially dispels the traditional 
guarantee of CI professionals that individuals can report any threat 
without concern that these threats will be acted upon—under the generally 
accepted belief that sophisticated FISS would not compromise their 
clandestine activities by overtly following through on threats. The CI 
community must address this new challenge from a perspective that is 
tantamount to a “‘witness protection’ approach. As the ‘‘threat 
recruitment” strategy to HUMINT source operations more frequently 
succeeds, it can proliferate at an unmanageable rate if the CI and law 
enforcement communities do not have a credible program to protect those 
who choose to report the hostile efforts, rather than succumb to them out 
of fear. While the “threat recruitment’? approach is the most apparent, and 
perhaps the most extreme, variation in the traditional FISS model, a more 
thorough assessment would certainly find that many other variations exist 
for which current CI programs are not adequately postured to address. 


REAFFIRMING THE Cl PRIORITY 


The National CI Strategy and other formal CI community products clearly 
imply that the nontraditional threat is being addressed by the U.S. 
government as an all-encompassing priority CI mission. If the CI 
community is indeed assuming the responsibility of addressing the majority 
of these threats, then implied with this national commitment is the 
requirement to establish viable programs for doing so. The CI community 
cannot assume that the intelligence collection efforts of nontraditional 
organizations can be effectively countered within the construct of current 
CI programs and processes. 

Exceptions to the generalization of nontraditional adversarial intelligence 
collection threats can be discerned. Among them are terrorists seeking 
information to support their aspirations for the development of weapons 
of mass destruction (WMD) and mercenary groups seeking high-end 
technology information to sell. Such exceptions represent perhaps the 
strongest justification to proactively address the challenge of intelligence 
collection by nontraditional actors. A collection effort that operates 
aggressively and without constraint while targeting information that, if 
obtained, would cause significant damage to U.S. national security 
represents the most difficult and potentially dangerous set of CI problems. 


INTERNATIONAL JOURNAL OF INTELLIGENCE 


Downloaded by [The Aga Khan University] at 07:57 10 October 2014 


COUNTERING NONTRADITIONAL HUMINT COLLECTION THREATS 519 


The protection of information that might otherwise enable nontraditional 
adversaries to operate more effectively is not the only reason to ensure that 
CI is an integral component of a full-spectrum enterprise. As with other 
preoperational activities, the detection of such activities prior to their 
execution is among the most effective means of threat neutralization and 
prevention. 

Coordination among CI and law enforcement will require deconfliction of 
the distinctions between those intelligence collection activities which are of CI 
concern and the general illegal activities which are an overriding concern to 
law enforcement. While the law enforcement community clearly has the 
lead in countering nontraditional adversaries, especially those in the criminal 
justice sectors, the CI community must assume an active role if the intelligence 
collection aspects of the adversarial operational process are to be effectively 
addressed. This can be accomplished only by the establishment of 
relationships under which CI elements can directly support law enforcement 
partners, or through the development of CI capabilities that are organic to 
those agencies. 

The nontraditional adversarial adaptation of traditional HUMINT source 
methods may portend a new era of CI challenges. Supporting the expansion 
of the current CI focus and the development of progressive methodologies to 
address this rapidly emerging threat is simply justified. Otherwise, the 
consequences of running behind, and reacting to, the threats as they 
mature are inevitable, and potentially devastating.'® 
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to accomplish its mission, including but not limited to espionage, other 
criminal activity, unauthorized disclosure of information and loss or 
degradation of departmental resources or capabilities. Terms and Definitions of 
Interest for DOD Counterintelligence Professionals. 

An access agent is defined as an individual used to acquire information on an 
otherwise inaccessible target, or one who facilitates contact with a target 
individual or entry into a facility. Ibid. 

The National Counterintelligence Strategy of the United States, Foreword, p. v1. 
““... the potential consequences of counterintelligence failures can be immediate 
and devastating...” 
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